Elevator installations comprise a safety system for ensuring sufficient operational safety. The requirements are fixed by various standards and regulations. These safety systems are usually constructed to be largely independent and superordinate to the rest of the elevator systems. The safety system can influence the elevator installation and is for that purpose connected with, for example, the drive or brake unit of the elevator installation. If sufficient operational safety is not guaranteed, travel operation is interrupted.
A safety system of that kind can be constructed as a safety circuit in which a plurality of safety elements such as, for example, safety contacts and safety switches are arranged in series connection. The contacts monitor, for example, whether a shaft door or the car door is open. The elevator car can be moved only when the safety circuit and thus also all safety contacts integrated therein are closed. Some of the safety elements are actuated by the doors. Other safety elements such as, for example, an over-travel switch are actuated or triggered by the elevator car. The safety circuit interrupts travel operation if the safety circuit is opened.
Safety systems with safety circuits of this kind are subject to numerous disadvantages such as, for example, inherent problems of a voltage drop in the safety circuit and a comparatively high susceptibility to fault. In addition, the safety circuit does not allow a specific diagnosis, since if the safety circuit is open it can be established only that at least one safety contact is open.
It was therefore proposed to equip elevator installations with a safety bus system instead of the mentioned safety circuit. The safety bus system typically comprises a control unit, a safety bus and one or more bus junctions. Various safety elements such as, for example, door contacts, lock contacts or buffer contacts are interrogated by way of the bus junctions. If a report of the safety elements does not correspond with a target magnitude, the safety system can influence the control of the elevator installation and, for example, initiate emergency switching-off. The safety system can in that case pass into an emergency state in which operation of the elevator installation is, for example, blocked or is possible only to reduced extent. Typical emergency states comprise, for example, emergency switching-off, for example as a consequence of the elevator car exceeding a speed or an unclosed door or a maintenance state in which only maintenance journeys are possible. A safety system of that kind is described in, for example, WO 03/024856 A.
If the safety system passes into an emergency state, it is necessary to reset the safety system to a normal state in which normal operation of the elevator installation is released. The safety system is often set back (‘reset’) to the normal state by a service engineer after successful checking of the elevator installation. Resetting can in that case be carried out, for example, directly at an access point of the safety system. This can be arranged in, for example, a closed maintenance area so as to ensure that only an authorized person can trigger the resetting. However, the safety system is thus often difficult to access, whereby resetting can be time-consuming and, for example, inconvenient for the service engineer. Resetting could in certain cases also be carried out automatically by an elevator control. However, in this case the requisite safety steps for resetting would often not be guaranteed, since an elevator control as an unsafe system is subordinate to the safety system in a safety hierarchy.